Payara — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by Payara (payara). https://vulnogram.org/seaview/icons/payara.png Payara — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-92082 · 6.3 MEDIUM — Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts https://vulnogram.org/CVE-2026-92082 https://vulnogram.org/CVE-2026-92082 By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ht… Medium Tue, 15 Sep 2026 14:04:25 GMT CVE-2026-12986 · 7.3 HIGH https://vulnogram.org/CVE-2026-12986 https://vulnogram.org/CVE-2026-12986 A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthentica… High Wed, 24 Jun 2026 14:08:02 GMT CVE-2025-14340 · 7.3 HIGH — Admin Account Takeover via malicious URL payload https://vulnogram.org/CVE-2025-14340 https://vulnogram.org/CVE-2025-14340 Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload. High Wed, 18 Feb 2026 13:39:11 GMT CVE-2025-1534 · 6.8 MEDIUM — Cross-site Scripting (Stored) https://vulnogram.org/CVE-2025-1534 https://vulnogram.org/CVE-2025-1534 CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5… Medium Tue, 01 Apr 2025 03:25:30 GMT CVE-2024-45687 · 2.4 LOW — HTTP Server incorrectly accepting disallowed characters within header values https://vulnogram.org/CVE-2024-45687 https://vulnogram.org/CVE-2024-45687 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulat… Low Tue, 21 Jan 2025 16:35:43 GMT CVE-2024-8215 · 8.7 HIGH — Payload Injection Attack via Management REST interface https://vulnogram.org/CVE-2024-8215 https://vulnogram.org/CVE-2024-8215 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.… High Tue, 08 Oct 2024 15:17:10 GMT CVE-2024-8097 · 6.7 MEDIUM — Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level https://vulnogram.org/CVE-2024-8097 https://vulnogram.org/CVE-2024-8097 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0… Medium Wed, 11 Sep 2024 16:32:10 GMT CVE-2024-7312 · 7 HIGH — REST Interface Link Redirection via Host parameter https://vulnogram.org/CVE-2024-7312 https://vulnogram.org/CVE-2024-7312 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9,… High Wed, 11 Sep 2024 15:28:43 GMT CVE-2023-41699 · 6.1 MEDIUM 🌩️ — Payara Platform: URL Redirection to untrusted site using FORM authentication https://vulnogram.org/CVE-2023-41699 https://vulnogram.org/CVE-2023-41699 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0… Medium Network Exploitable Wed, 15 Nov 2023 19:54:23 GMT